# CVEs published 2008-02-12

91 CVEs were published on February 12, 2008: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2007-3676](https://cve.now/CVE-2007-3676.md): IBM DB2 Universal Database (UDB) Administration Server (DAS) 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a (no CVSS)
- [CVE-2007-5757](https://cve.now/CVE-2007-5757.md): Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local use (no CVSS)
- [CVE-2008-0103](https://cve.now/CVE-2008-0103.md): Unspecified vulnerability in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to e (no CVSS)
- [CVE-2007-0065](https://cve.now/CVE-2007-0065.md): Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, (no CVSS)
- [CVE-2007-0216](https://cve.now/CVE-2007-0216.md): wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to ex (no CVSS)
- [CVE-2008-0076](https://cve.now/CVE-2008-0076.md): Unspecified vulnerability in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via cr (no CVSS)
- [CVE-2008-0077](https://cve.now/CVE-2008-0077.md): Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by ass (no CVSS)
- [CVE-2008-0078](https://cve.now/CVE-2008-0078.md): Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attack (no CVSS)
- [CVE-2008-0080](https://cve.now/CVE-2008-0080.md): Heap-based buffer overflow in the WebDAV Mini-Redirector in Microsoft Windows XP SP2, Server 2003 SP1 and SP2, and Vista allows remote attac (no CVSS)
- [CVE-2008-0102](https://cve.now/CVE-2008-0102.md): Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a cra (no CVSS)
- [CVE-2008-0104](https://cve.now/CVE-2008-0104.md): Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a cra (no CVSS)
- [CVE-2008-0105](https://cve.now/CVE-2008-0105.md): Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute ar (no CVSS)
- [CVE-2008-0108](https://cve.now/CVE-2008-0108.md): Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Su (no CVSS)
- [CVE-2008-0109](https://cve.now/CVE-2008-0109.md): Word in Microsoft Office 2000 SP3, XP SP3, Office 2003 SP2, and Office Word Viewer 2003 allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2008-0009](https://cve.now/CVE-2008-0009.md): The vmsplice\_to\_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before (no CVSS)
- [CVE-2008-0010](https://cve.now/CVE-2008-0010.md): The copy\_from\_user\_mmap\_sem function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer (no CVSS)
- [CVE-2008-0074](https://cve.now/CVE-2008-0074.md): Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown (no CVSS)
- [CVE-2008-0075](https://cve.now/CVE-2008-0075.md): Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 through 6.0 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2008-0084](https://cve.now/CVE-2008-0084.md): Unspecified vulnerability in the TCP/IP support in Microsoft Windows Vista allows remote DHCP servers to cause a denial of service (hang and (no CVSS)
- [CVE-2008-0088](https://cve.now/CVE-2008-0088.md): Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM (no CVSS)
- [CVE-2008-0163](https://cve.now/CVE-2008-0163.md): Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc. (no CVSS)
- [CVE-2008-0600](https://cve.now/CVE-2008-0600.md): The vmsplice\_to\_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer before dereference, whic (no CVSS)
- [CVE-2008-0729](https://cve.now/CVE-2008-0729.md): Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service (memory exhaustion and device crash) via (no CVSS)
- [CVE-2008-0730](https://cve.now/CVE-2008-0730.md): The (1) Simplified Chinese, (2) Traditional Chinese, (3) Korean, and (4) Thai language input methods in Sun Solaris 10 create files and dire (no CVSS)
- [CVE-2008-0731](https://cve.now/CVE-2008-0731.md): The Linux kernel before 2.6.18.8-0.8 in SUSE openSUSE 10.2 does not properly handle failure of an AppArmor change\_hat system call, which mig (no CVSS)
- [CVE-2008-0732](https://cve.now/CVE-2008-0732.md): The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtai (no CVSS)
- [CVE-2008-0037](https://cve.now/CVE-2008-0037.md): X11 in Apple Mac OS X 10.5 through 10.5.1 does not properly handle when the "Allow connections from network client" preference is disabled, (no CVSS)
- [CVE-2008-0038](https://cve.now/CVE-2008-0038.md): Launch Services in Apple Mac OS X 10.5 through 10.5.1 allows an uninstalled application to be launched if it is in a Time Machine backup, wh (no CVSS)
- [CVE-2008-0039](https://cve.now/CVE-2008-0039.md): Unspecified vulnerability in Mail in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary commands via a crafted file:// URL. (no CVSS)
- [CVE-2008-0040](https://cve.now/CVE-2008-0040.md): Unspecified vulnerability in NFS in Apple Mac OS X 10.5 through 10.5.1 allows remote attackers to cause a denial of service (system shutdown (no CVSS)
- [CVE-2008-0041](https://cve.now/CVE-2008-0041.md): Parental Controls in Apple Mac OS X 10.5 through 10.5.1 contacts www.apple.com "when a website is unblocked," which allows remote attackers (no CVSS)
- [CVE-2008-0042](https://cve.now/CVE-2008-0042.md): Argument injection vulnerability in Terminal.app in Terminal in Apple Mac OS X 10.4.11 and 10.5 through 10.5.1 allows remote attackers to ex (no CVSS)
- [CVE-2008-0318](https://cve.now/CVE-2008-0318.md): Integer overflow in the cli\_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows remote attackers to cause a denia (no CVSS)
- [CVE-2008-0636](https://cve.now/CVE-2008-0636.md): Level Platforms, Inc. (no CVSS)
- [CVE-2008-0726](https://cve.now/CVE-2008-0726.md): Integer overflow in Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via crafted arguments to th (no CVSS)
- [CVE-2008-0728](https://cve.now/CVE-2008-0728.md): The unmew11 function in libclamav/mew.c in libclamav in ClamAV before 0.92.1 has unknown impact and attack vectors that trigger "heap corrup (no CVSS)
- [CVE-2007-5659](https://cve.now/CVE-2007-5659.md): Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with (CVSS 7.8, KEV)
- [CVE-2007-5663](https://cve.now/CVE-2007-5663.md): Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file that calls an insecure J (no CVSS)
- [CVE-2007-5666](https://cve.now/CVE-2007-5666.md): Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.1 and earlier allows local users to execute arbitrary code via a malicio (no CVSS)
- [CVE-2008-0416](https://cve.now/CVE-2008-0416.md): Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1 (no CVSS)
- [CVE-2008-0420](https://cve.now/CVE-2008-0420.md): modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 do (no CVSS)
- [CVE-2008-0215](https://cve.now/CVE-2008-0215.md): Multiple unspecified vulnerabilities in HP Storage Essentials Storage Resource Management (SRM) before 6.0.0 allow remote attackers to obtai (no CVSS)
- [CVE-2008-0714](https://cve.now/CVE-2008-0714.md): SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL commands via the username p (no CVSS)
- [CVE-2008-0715](https://cve.now/CVE-2008-0715.md): Buffer overflow in ACDSee Photo Manager 8.1, 9.0, and 10.0 allows user-assisted remote attackers to execute arbitrary code via a malformed X (no CVSS)
- [CVE-2008-0716](https://cve.now/CVE-2008-0716.md): The agent in Symantec Altiris Notification Server before 6.0 SP3 R7 allows local users to gain privileges via a "Shatter" style attack. (no CVSS)
- [CVE-2008-0717](https://cve.now/CVE-2008-0717.md): Cross-site scripting (XSS) vulnerability in Caching Proxy (CP) 5.1 through 6.1 in IBM WebSphere Edge Server, when CGI mapping rules are enab (no CVSS)
- [CVE-2008-0718](https://cve.now/CVE-2008-0718.md): Unspecified vulnerability in the USB Mouse STREAMS module (usbms) in Sun Solaris 9 and 10, when 64-bit mode is enabled, allows local users t (no CVSS)
- [CVE-2008-0719](https://cve.now/CVE-2008-0719.md): SQL injection vulnerability in customer\_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 all (no CVSS)
- [CVE-2008-0720](https://cve.now/CVE-2008-0720.md): Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2008-0721](https://cve.now/CVE-2008-0721.md): SQL injection vulnerability in index.php in the Sermon (com\_sermon) 0.2 component for Mambo allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-0722](https://cve.now/CVE-2008-0722.md): Cross-site scripting (XSS) vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2008-0723](https://cve.now/CVE-2008-0723.md): Cross-site scripting (XSS) vulnerability in mynews.inc.php in MyNews 1.6.4, and other earlier 1.6.x versions, allows remote attackers to inj (no CVSS)
- [CVE-2008-0724](https://cve.now/CVE-2008-0724.md): The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, whic (no CVSS)
- [CVE-2008-0725](https://cve.now/CVE-2008-0725.md): Multiple heap-based buffer overflows in the (1) FTP service and (2) administration service in Titan FTP Server 6.0.5.549 allow remote attack (no CVSS)
- [CVE-2007-5333](https://cve.now/CVE-2007-5333.md): Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-6286](https://cve.now/CVE-2007-6286.md): Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty reque (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2008-0002](https://cve.now/CVE-2008-0002.md): Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter proces (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2008-0669](https://cve.now/CVE-2008-0669.md): Cross-site scripting (XSS) vulnerability in search.cgi in Sift Unity allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2008-0670](https://cve.now/CVE-2008-0670.md): SQL injection vulnerability in index.php in the Noticias (com\_noticias) 1.0 component for Joomla! allows remote attackers to execute arbitra (no CVSS)
- [CVE-2008-0671](https://cve.now/CVE-2008-0671.md): Stack-based buffer overflow in the add\_line\_buffer function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2008-0672](https://cve.now/CVE-2008-0672.md): The process\_chat\_input function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to cause a denial of service (application cra (no CVSS)
- [CVE-2008-0673](https://cve.now/CVE-2008-0673.md): TinTin++ 1.97.9 and WinTin++ 1.97.9 open files on the basis of an inbound file-transfer request, before the user has an opportunity to decli (no CVSS)
- [CVE-2008-0675](https://cve.now/CVE-2008-0675.md): SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pre-1.0 and earlier al (no CVSS)
- [CVE-2008-0676](https://cve.now/CVE-2008-0676.md): Cross-site scripting (XSS) vulnerability in search.php in A-Blog 2 allows remote attackers to inject arbitrary web script or HTML via the wo (no CVSS)
- [CVE-2008-0677](https://cve.now/CVE-2008-0677.md): SQL injection vulnerability in blog.php in A-Blog 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a news (no CVSS)
- [CVE-2008-0678](https://cve.now/CVE-2008-0678.md): SQL injection vulnerability in index.php in BlogPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a (no CVSS)
- [CVE-2008-0679](https://cve.now/CVE-2008-0679.md): Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2008-0680](https://cve.now/CVE-2008-0680.md): SNMPd in MikroTik RouterOS 3.2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP SET reques (no CVSS)
- [CVE-2008-0681](https://cve.now/CVE-2008-0681.md): SQL injection vulnerability in index.php in PHPShop 0.8.1 allows remote attackers to execute arbitrary SQL commands via the product\_id param (no CVSS)
- [CVE-2008-0682](https://cve.now/CVE-2008-0682.md): SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2008-0683](https://cve.now/CVE-2008-0683.md): SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st\_newsletter) plugin for WordPress allows remote attacker (no CVSS)
- [CVE-2008-0684](https://cve.now/CVE-2008-0684.md): Cross-site scripting (XSS) vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-0685](https://cve.now/CVE-2008-0685.md): SQL injection vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to execute arbitrary SQL commands via the CatID p (no CVSS)
- [CVE-2008-0686](https://cve.now/CVE-2008-0686.md): SQL injection vulnerability in index.php in the NeoReferences (com\_neoreferences) 1.3.1 and 1.3.3 component for Joomla! allows remote attack (no CVSS)
- [CVE-2008-0687](https://cve.now/CVE-2008-0687.md): Cross-site scripting (XSS) vulnerability in siteadmin/editor\_files/includes/load\_message.php in the Youtube Clone Script allows remote attac (no CVSS)
- [CVE-2008-0688](https://cve.now/CVE-2008-0688.md): Cross-site scripting (XSS) vulnerability in catalog.php in Smartscript Domain Trader 2.0 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2008-0689](https://cve.now/CVE-2008-0689.md): SQL injection vulnerability in index.php in the Marketplace (com\_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla! allows remote attack (no CVSS)
- [CVE-2008-0690](https://cve.now/CVE-2008-0690.md): SQL injection vulnerability in index.php in the mosDirectory (com\_directory) 2.3.2 component for Joomla! allows remote attackers to execute (no CVSS)
- [CVE-2008-0691](https://cve.now/CVE-2008-0691.md): Multiple cross-site scripting (XSS) vulnerabilities in admin\_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remot (no CVSS)
- [CVE-2008-0692](https://cve.now/CVE-2008-0692.md): SQL injection vulnerability in bidhistory.php in iTechBids 3 Gold and 5.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-0693](https://cve.now/CVE-2008-0693.md): Stack-based buffer overflow in PQCore.exe in Print Manager Plus 2008 Client Billing and Authentication 7.0.127.16 allows remote attackers to (no CVSS)
- [CVE-2008-0694](https://cve.now/CVE-2008-0694.md): Cross-site scripting (XSS) vulnerability in the HTTP Server in IBM OS/400 V5R3M0 and V5R4M0 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-0695](https://cve.now/CVE-2008-0695.md): SQL injection vulnerability in index.php in BookmarkX script 2007 allows remote attackers to execute arbitrary SQL commands via the topicid (no CVSS)
- [CVE-2008-0696](https://cve.now/CVE-2008-0696.md): IBM DB2 UDB before 8.2 Fixpak 16 does not properly check authorization for the ALTER TABLE statement, which has unknown impact and attack ve (no CVSS)
- [CVE-2008-0697](https://cve.now/CVE-2008-0697.md): Unspecified vulnerability in DB2PD in IBM DB2 UDB before 8.2 Fixpak 16 allows local users to gain root privileges via unspecified vectors. (no CVSS)
- [CVE-2008-0698](https://cve.now/CVE-2008-0698.md): Buffer overflow in the DAS server in IBM DB2 UDB before 8.2 Fixpak 16 has unknown attack vectors, and an impact probably involving "invalid (no CVSS)
- [CVE-2008-0699](https://cve.now/CVE-2008-0699.md): Unspecified vulnerability in the ADMIN\_SP\_C procedure (SYSPROC.ADMIN\_SP\_C) in IBM DB2 UDB before 8.2 Fixpak 16, 9.1 before FP4a, and 9.5 bef (no CVSS)
- [CVE-2008-0700](https://cve.now/CVE-2008-0700.md): Cross-site scripting (XSS) vulnerability in search.php in Crux Software CruxCMS 3.0 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2008-0701](https://cve.now/CVE-2008-0701.md): ActivationHandler in Magnolia CE 3.5.x before 3.5.4 does not check permissions during importing, which allows remote attackers to have an un (no CVSS)
- [CVE-2008-0702](https://cve.now/CVE-2008-0702.md): Multiple heap-based buffer overflows in Titan FTP Server 6.03 and 6.0.5.549 allow remote attackers to cause a denial of service (daemon cras (no CVSS)
- [CVE-2008-0703](https://cve.now/CVE-2008-0703.md): Multiple directory traversal vulnerabilities in sflog! 0.96 allow remote attackers to read arbitrary files via a .. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.